M4Pro安装ELK(ElasticSearch+LogStash+Kibana)踩坑记录

发布于:2025-06-01 ⋅ 阅读:(26) ⋅ 点赞:(0)

ElasticSearch安装,启动端口9200:

docker pull elasticsearch:8.13.0

 

新增配置文件elasticsearch.yml:

cd /opt/homebrew/etc/

mkdir elasticsearch_config

cd elasticsearch_config

vi elasticsearch.yml

cluster.name: "nfturbo-cluster"

network.host: 0.0.0.0

http.cors.enabled: true

http.cors.allow-origin: "*"

xpack.security.enabled: false

 

启动ElasticSearch,启动端口9200、9300:

docker run --name elasticsearch -p 9200:9200  -p 9300:9300  -e "discovery.type=single-node" -e _JAVA_OPTIONS=-XX:UseSVE=0 -e ES_JAVA_OPTS="-Xms256m -Xmx512m" -v /opt/homebrew/etc/elasticsearch_config/elasticsearch.yml:/usr/share/elasticsearch8/config/elasticsearch.yml -v /home/package/es/data:/usr/share/elasticsearch8/data -v /home/package/es/plugins:/usr/share/elasticsearch8/plugins -d elasticsearch:8.13.0

 

查看运行日志:

docker logs elasticsearch

curl localhost:9200

 

踩坑:

--查看容器 id,替换下面的030926f40873,使用实际的containerid

docker ps

--进入容器内部docker exec -it --user root 030926f40873 /bin/bash

-- 安装vim 命令

apt-get update

apt-get install vim

--修改elasticsearch.yml

vi config/elasticsearch.yml

将 xpack.security.enabled: true 改为:xpack.security.enabled: false

退出容器并重启:docker restart 030926f40873

 

docker logs elasticsearch

curl localhost:9200

{ "name" : "3981174ed6df", "cluster_name" : "nfturbo-cluster", "cluster_uuid" : "9blwCZsiSiOapFjQEF42cA", "version" : { "number" : "8.13.0", "build_flavor" : "default", "build_type" : "docker","build_hash" : "09df99393193b2c53d92899662a8b8b3c55b45cd", "build_date" : "2024-03-22T03:35:46.757803203Z","build_snapshot" : false, "lucene_version" : "9.10.0", "minimum_wire_compatibility_version" : "7.17.0","minimum_index_compatibility_version" : "7.0.0" }, "tagline" : "You Know, for Search"}

 

浏览器访问:127.0.0.1:9200,返回同样结果即安装成功。

 

 

 

Kibana安装,启动端口5601:

docker pull kibana:8.13.0

 

查看ElasticSearch所在容器的IP,3981174ed6df替换成实际es容器的ID:

docker inspect 1e2a10aa9f34 |grep IPAddress

            "SecondaryIPAddresses": null,

            "IPAddress": "172.17.0.3",

                    "IPAddress": "172.17.0.3"

这里的172.17.0.3即es所在docker容器的内网IP。

ps:docker容器之间是完全隔离的,不同的docker容器可以理解为不同的服务器,部署多个docker容器的主机是这些docker容器的宿主机。

docker容器中的应用如果要访问宿主机上运行的服务,需要指定宿主机IP,而不是docker容器的本地IP

 

新增配置文件kibana.yaml:

cd elasticsearch_config

vi kibana.yaml

#server.port: 5601

server.host: 0.0.0.0

elasticsearch.hosts: [ "http://172.17.0.3:9200" ] # 改成 es 的docker容器内网 ip

#elasticsearch.username: "elastic"

#elasticsearch.password: "123456"

xpack.monitoring.ui.container.elasticsearch.enabled: true

i18n.locale: "zh-CN"

 

启动Kibana,启动端口5601:

sudo docker run --name kibana -d -p 5601:5601 -v /opt/homebrew/etc/elasticsearch_config/kibana.yaml:/usr/share/kibana/config/kibana.yaml kibana:8.13.0

踩坑:kibana宿主机和挂载容器的配置文件后缀必须是yaml,否则会挂载成目录(宿主机是文件,就会导致挂载失败)

 

踩坑:跳过token认证:

--查看容器 id,替换下面的030926f40873,使用实际的containerid

docker ps

--进入容器内部docker exec -it --user root 030926f40873 /bin/bash

-- 安装vim 命令

apt-get update

apt-get install vim

--修改kibana.yml

vi config/kibana.yml

elasticsearch.hosts: [ "http://172.17.0.2:9200" ]

# elasticsearch.username: "elastic"

# elasticsearch.password: "123456"

退出容器并重启:docker restart 030926f40873

登录Kibana:

http://127.0.0.1:5601/app/home#/


网站公告

今日签到

点亮在社区的每一天
去签到